To block an email domain at Shopify checkout, create a checkout validation that checks the shopper's email for a named domain, blocks a match, and displays a message explaining what address the shopper should use instead. With CartBlock, the practical deny-rule pattern is Email partially contains @example.com → block checkout.

This guide covers named-domain allow and deny rules for B2B access, repeat abuse, and internal or competitor-domain policies. It does not cover disposable-email detection, which depends on a maintained list of temporary-email providers.

Interface checked September 30, 2026: The CartBlock version tested for this guide included an Email condition and a Partially contains operator. Interface labels and capabilities can change, so verify the available operators in your installed version. The setup below uses a complete @domain value and includes tests for partial-match limits.

When should you block or allow an email domain?

An email-domain rule is useful when the domain itself represents a known store policy. Common examples include:

  • B2B access: Allow checkout only for approved company or partner domains in a private purchasing flow.
  • Repeat abuse: Block a domain after documented misuse when a domain-wide restriction is proportionate to the risk.
  • Internal orders: Prevent employees from using a corporate domain in a consumer storefront or route staff purchases through an internal process.
  • Competitor or reseller policy: Restrict a named business domain when your written sales policy supports it.

Domain rules are broad. Blocking @example.com affects every address at that domain, including people you have never reviewed. Before launching one, document why the whole domain belongs in scope, who approved the rule, when it will be reviewed, and what legitimate buyers can do next.

Do not use a domain rule as proof of identity. An address at an allowed domain does not confirm employment, purchasing authority, or an approved B2B account. When eligibility matters, combine the email condition with a stronger signal such as customer login, a customer tag, or your established B2B approval process.

Named-domain blocking is not disposable-email blocking

These two controls solve different problems:

Control What it checks Best fit Maintenance need
Named-domain rule A specific domain your team chose, such as @partner.example B2B access, internal policy, or a documented abuse case Review a small policy list and its business owner
Disposable-email rule Domains operated by temporary inbox services Discouraging short-lived contact addresses Keep a changing provider list current and monitor false positives

If your goal is to reject temporary inboxes, follow the separate guide to block disposable email addresses at Shopify checkout. Do not label a normal business or consumer domain “disposable” simply because one order was risky.

Choose the right control for your email-domain policy

Write the invalid state before opening the rule builder.

Deny one named domain

Use a deny rule when most email domains are acceptable and one documented domain is not:

Email partially contains @blocked-example.com → block checkout

This is usually the safer starting point for a public store because it changes checkout behavior for a narrow, known group.

Restrict access to approved business buyers

Do not use Partially does not contains as a domain allowlist unless your installed CartBlock version exposes an exact-domain or ends-with operator and you have verified its boundary behavior. A substring check can be bypassed by a deceptive suffix. For example, this address contains the approved text but does not belong to the approved domain:

buyer@approved-example.com.attacker.example

For B2B authorization, require customer login and use a maintained customer tag, Shopify B2B account, or another verified account signal. These controls connect access to an approved customer record rather than unverified text in an email field.

See the guide to require customer login before Shopify checkout if anonymous checkout would undermine the policy.

Goal Recommended signal Main risk Maintenance
Deny one named domain Complete @domain value with a tested deny rule Partial matching may also catch deceptive suffixes Review the domain, rule owner, and exceptions
Limit B2B purchasing Login plus customer tag or Shopify B2B account Email text alone does not prove identity or authority Maintain approved customer records
Reject temporary inboxes Dedicated disposable-email control Provider lists change and can create false positives Update the provider list and monitor results

How to block an email domain at Shopify checkout with CartBlock

The example below denies @blocked-example.com. Replace it with a domain that your business has reviewed and approved for restriction.

Before you start

Prepare the following:

  • The exact domain, including the @ prefix.
  • A written reason for applying the policy to the entire domain.
  • A customer-facing correction or support path.
  • At least 1 matching test address and 2 non-matching addresses.
  • An owner and review date for the rule.

Use an obviously fictional domain in documentation and screenshots. Do not expose a real customer's email address in a shared test record.

1. Create a checkout validation

Open CartBlock from Shopify admin and create a checkout validation. Give it an operational name such as Block email domain – blocked-example.com.

If this is your first rule, review the broader Shopify checkout validation setup guide before activation.

2. Select the Email input

Add a condition and choose Email. This tells the validation to evaluate the contact email present during checkout.

Do not substitute a customer note, company-name field, or shipping-address field. Those inputs can contain different text and do not represent the checkout email.

3. Choose Partially contains

For a deny rule, select Partially contains and enter the complete suffix with its @ prefix:

@blocked-example.com

The @ makes the value more specific than entering blocked-example.com alone. It helps avoid matching a domain-like phrase elsewhere in a longer address. The visible CartBlock controls do not document boundary matching, case folding, or whitespace normalization, so testing remains essential.

Create separate, clearly named validations for separate policy decisions unless your installed builder explicitly supports a reviewed list format. Small rules are easier to test, disable, and audit.

4. Write a corrective message

Tell the shopper what happened and what they can do:

Orders using this email domain cannot be completed here. Use an eligible business email or contact our support team for help.

For an internal purchasing policy, a more specific message may be useful:

Employee orders must use the internal purchasing portal. Contact the operations team if you need access.

Avoid accusations such as “fraudulent domain” or “competitor detected.” The validation knows only that the text matched your rule; it does not know the shopper's intent.

5. Review and activate the invalid state

Read the saved rule as a sentence:

Block checkout when Email partially contains @blocked-example.com.

Confirm the direction is correct. Partially contains creates a deny rule; Partially does not contains creates a broad allow-only rule. Save and activate the validation using the controls in your installed CartBlock version.

How to test an email-domain rule at Shopify checkout

Run a small test matrix in the same storefront and checkout paths your customers use.

Test email Expected result
buyer@blocked-example.com Blocked with the corrective message
buyer@allowed-example.com Can continue
buyer@sub.blocked-example.com Record actual behavior and decide whether subdomains belong in scope
buyer@blocked-example.com.allowed-example.com Likely matches a partial deny rule; confirm and document the intended policy
BUYER@BLOCKED-EXAMPLE.COM Record case-handling behavior
Email with leading or trailing space Record normalization behavior
Guest checkout Follows the same documented policy or a deliberate exception
Accelerated checkout used by your store Produces the expected result in that path

Test the active rule in a development or test checkout and confirm that blocked buyers cannot continue. Shopify's cart and checkout validation documentation recommends testing validation behavior across the cart and checkout surfaces where errors can appear.

If the result is unexpected, confirm that the validation is active, the operator points in the intended direction, the value includes @, and the current checkout contains the email you think it does. Then use the checkout validation troubleshooting guide to isolate rule-status and condition issues.

Avoid these email-domain rule mistakes

Blocking a public email provider

Blocking a provider such as Gmail or Outlook would affect a large number of unrelated shoppers. A single abusive order is not evidence that an entire public domain should be denied.

Using a denylist for B2B identity

A denylist says who cannot proceed; it does not prove who is an approved buyer. Use account login, customer tags, Shopify B2B records, or another approval control when authorization matters.

Reversing allow-rule logic

A substring-based allow-only rule can both block legitimate buyers and admit deceptive suffixes. Do not activate it as a B2B authorization control. Use a verified customer account signal instead.

Hiding the recovery path

A vague “Checkout unavailable” message creates support work. Tell legitimate shoppers which address to use or where to request an exception.

Leaving rules without an owner

Business relationships and abuse patterns change. Record the reason, approver, creation date, review date, and removal criteria for each named domain.

Frequently asked questions

Can Shopify natively block orders by email domain?

Not through a standard Shopify admin setting. Shopify supports cart and checkout validation through compatible public apps built with Shopify Functions. A validation app such as CartBlock can evaluate checkout data and return an error when a configured rule fails.

Should I block the domain with or without the @ symbol?

Use the complete @domain value for a more specific partial-text match, then test it. The visible CartBlock interface does not document regex, boundary matching, or normalization controls.

Can I allow only company email addresses for a B2B store?

Do not rely on a partial-text email rule for B2B authorization. Require sign-in and use a maintained customer tag, Shopify B2B account, or another verified account signal when purchasing authority matters. Use an email-domain condition only as a secondary policy check if its exact-domain behavior has been verified.

Does this block disposable email addresses?

Only if you manually add a known disposable provider domain. Disposable-email control is a separate workflow because provider lists change and need ongoing review.

Will an email-domain rule stop all fraudulent orders?

No. It enforces a text-based checkout policy for the domains you configure. Use it alongside Shopify's fraud analysis, payment controls, fulfillment review, and other risk processes appropriate to your store.

Enforce a narrow, explainable domain policy

A reliable way to block an email domain at Shopify checkout starts with a precise value, a documented reason, a useful error message, and edge-case testing. Start with the narrowest rule that addresses the policy, monitor false positives, and remove the restriction when its justification expires.

Explore CartBlock on the Shopify App Store to create checkout validations without custom code, then test the rule against the checkout paths your store supports.